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Why  GAO  Did  This  Study 

Femes  are  a  vital  component  of  the 
U.S.  transportation  system  and  2008 
data  show  that  U.S.  ferries  carried 
more  than  82  million  passengers  and 
over  25  milhon  vehicles.  Ferries  are 
also  potential  targets  for  terrorism  in 
the  United  States  and  have  been 
terrorist  targets  overseas.  GAO  was 
asked  to  review  ferry  security,  and 
this  report  addresses  the  extent  to 
which  (1)  the  Coast  Guard,  the  lead 
federal  agency  for  maritime  security, 
assessed  risk  in  accordance  with  the 
Department  of  Homeland  Security’s 
(DHS)  guidance  and  what  risks  it 
identified;  and  (2)  federal  agencies, 
ferry  and  facility  operators,  and  law 
enforcement  entities  have  taken 
actions  to  protect  ferries  and  their 
facilities.  GAO  reviewed  relevant 
requirements,  analyzed  2006  through 
2009  security  operations  data, 
interviewed  federal  and  industry 
officials,  and  made  observations  at 
five  domestic  and  one  international 
locations  with  varying  passenger 
volumes  and  relative  risk  profiles. 
Site  visits  provided  irtformation  on 
security,  but  were  not  projectable  to 
all  ports.  This  is  the  public  version  of 
a  sensitive  report  that  GAO  issued  in 
October  2010.  Information  that  DHS 
deemed  sensitive  has  been  redacted. 

What  GAO  Recommends 

GAO  recommends  that  the 
Commandant  of  the  Coast  Guard, 
after  evaluating  the  completed 
studies  on  ferry  security,  reassess 
vehicle  screening  requirements  and 
take  further  actions  to  enhance 
security,  if  determined  warranted. 
DHS  concurred  with  our 
recommendations. 

View  GAO-1 1-207  or  key  components. 

For  more  information,  contact  Stephen  L. 
Caldwell  at  (202)  512-9610  or 
caldwells@gao.gov. 


What  GAO  Found 

The  Coast  Guard  assessed  the  risk — including  threats,  vulnerabihties,  and 
consequences — to  ferries  in  accordance  with  DHS  guidance  on  risk 
assessment  and,  along  with  other  maritime  stakeholders,  identified  risks 
associated  with  explosive  devices,  among  other  things.  Although  in  April  2010, 
Coast  Guard  intelligence  officials  stated  that  there  have  been  no  credible 
terrorist  threats  identified  against  ferries  and  their  facilities  in  at  least  the  last 
12  months,  maritime  intelhgence  officials  have  identified  the  presence  of 
terrorist  groups  with  the  capabifity  of  attacking  a  ferry.  Many  of  the  Coast 
Guard,  ferry  system  and  law  enforcement  officials  GAO  spoke  with  generally 
believe  ferries  are  vulnerable  to  passenger-  or  vehicle-bome  improvised 
explosive  devices,  although  not  all  ferry  systems  transport  vehicles.  The  Coast 
Guard  has  also  identified  the  potential  consequences  of  an  attack,  which 
could  include  possible  loss  of  life  and  negative  economic  effects.  In  April 
2010,  Coast  Guard  officials  stated  that  the  relative  risk  to  ferries  is  increasing, 
as  evidenced  by  attacks  against  land-based  mass  transit  and  other  targets 
overseas. 

Federal  agencies — including  the  Coast  Guard,  the  Transportation  Security 
Administration  (TSA),  and  Customs  and  Border  Protection  (CBP) — ^ferry 
operators,  and  law  enforcement  entities  report  that  they  have  taken  various 
actions  to  enhance  the  security  of  ferries  and  facilities  and  have  implemented 
related  laws,  regulations,  and  guidance,  but  the  Coast  Guard  may  be  missing 
opportunities  to  enhance  ferry  security.  Security  measures  taken  by  the  Coast 
Guard  have  included  providing  a  security  presence  on  ferries  during  transit. 
Coast  Guard  officials  also  reported  that  they  are  revising  regulations  to 
improve  ferry  operator  training  and  developing  guidance  on  screening.  Ferry 
operators’  security  actions  have  included  developing  and  implementing 
security  plans  and  screening  vehicles  and  passengers,  among  other  things. 
However,  the  Coast  Guard  had  not  evaluated  and,  if  determined  warranted, 
acted  on  all  findings  and  recommendations  resulting  from  five  agency- 
contracted  studies  on  ferry  security  completed  in  2005  and  2006.  Reports  from 
these  studies  included  several  recommendations  for  standardizing  and 
enhancing  screening  across  ferry  operators.  Standards  for  internal  control  in 
the  federal  government  state  that  agencies  should  ensure  that  findings  of 
audits  and  other  reviews  are  promptly  resolved,  and  that  managers  take  action 
to  evaluate  and  resolve  matters  identified  in  these  audits  and  reviews.  As  a 
result  of  our  work  on  ferry  security,  in  August  2010,  Coast  Guard  officials 
stated  they  planned  to  review  the  reports.  Taking  action  to  address  the 
recommendations  in  these  reports,  if  determined  warranted  by  the  Coast 
Guard’s  evaluation,  could  enhance  ferry  security.  Furthermore,  Coast  Guard 
documents  from  2004  state  that  the  agency  should  reassess  vehicle  screening 
requirements  pending  the  completion  of  the  ferry  security  reports  or  if  the 
threat  changes.  However,  no  specific  plans  were  in  place  to  reassess  these 
requirements.  By  taking  action  to  reassess  its  screening  requirements,  the 
agency  would  be  better  positioned  to  determine  if  changes  are  warranted. 
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Abbreviations 


CBP  Customs  and  Border  Protection 

DHS  Department  of  Homeland  Security 

ISPS  International  Ship  and  Port  Facility  Security 

MTSA  Maritime  Transportation  Security  Act  of  2002 

SAFE  Port  Act  Security  and  Accountability  for  Every  Port  Act  of  2006 

TSA  Transportation  Security  Administration 

VIPR  Visible  Intermodal  Prevention  and  Response 
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United  States  Government  Acconntability  Office 
Washington,  DC  20548 


December  3,  2010 

The  Honorable  Bennie  G.  Thompson 
Chairman 

Committee  on  Homeland  Security 
House  of  Representatives 

Dear  Mr.  Chairman: 

Ferries  are  an  important  component  of  the  U.S.  transportation  system,  and 
according  to  respondents  to  the  2008  National  Census  of  Ferry  Operators, 
carried  more  than  82  million  passengers  and  over  25  million  vehicles.  ^ 
Ferries  are  also  potential  targets  for  terrorism  in  the  United  States  and 
have  been  terrorist  targets  overseas.  A  2005  Coast  Guard  study  stated  that 
as  part  of  the  U.S.  maritime  transportation  system,  ferry  operations  are 
potential  terrorist  targets,  and  according  to  a  2006  RAND  Corporation 
study,  certain  traits  inherent  to  ferries  make  them  especially  attractive  to 
terrorist  aggression.^  For  example,  the  RAND  study  reported  that  attacks 
on  ferries  are  easy  to  execute,  have  the  potential  to  kill  many  people,  are 
likely  to  capture  significant  media  attention,  and  can  be  exploited  to 
visibly  demonstrate  a  terrorist  group’s  salience  and  vibrancy.  While  these 
fears  have  not  been  realized  in  the  United  States,  ferries  and  their  facilities 
in  the  Philippines  have  repeatedly  been  targeted  by  terrorists.  For 
example,  successful  bombings  on  Philippine  ferries  killed  or  wounded  at 
least  130  people  in  2004  and  2005.  Attacks  on  ferries  and  their  facilities 
have  continued,  and  in  2009  there  were  three  more  attempted  bombings  in 
the  Philippines.  These  attacks  led  the  Transportation  Security 
Administration  (TSA) — the  lead  U.S.  federal  agency  for  transportation 
secmity — to  report  in  2009  that  violent  extremists  aroimd  the  Philippines 
have  the  intent  and  capability  to  attack  ferries  or  use  them  as  a  means  of 
conveyance  to  transport  materials.  Coast  Guard  and  Navy  intelligence 
officials  also  stated  that  that  the  overall  risk  to  ferries  may  be  increasing 


'Ferry  data  are  bjised  on  results  from  the  2008  National  Census  of  Ferry  Operators.  These 
data  were  self-reported  hy  respondents  to  the  census,  include  other  sources  of  ferry  data, 
and  are  the  latest  data  available.  The  Bureau  of  Transportation  Statistics  has  ferry  data 
available  for  censuses  taken  in  2000,  2006,  and  2008. 

''U.S.  Coast  Guard  Research  and  Development  Center,  National  Ferry  Security  Study 
(Groton,  Conn.:  May  2005);  Michael  D.  Greenberg,  Peter  Chalk,  Henry  H.  Willis,  Ivein 
Khilko,  and  David  S.  Ortiz,  Maritime  Terrorism:  Risk  and  Liability  (Santa  Monica,  Calif.: 
RAND  Corporation,  2006). 
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given  the  attempts  in  the  Philippines  and  the  attacks  against  land-based 
mass  transit  and  other  soft  targets  overseas.  Although  not  caused  by  a 
terrorist  attack,  one  of  the  greatest  maritime  disasters  ever  occurred  in  the 
Philippines  in  1987  when  an  overloaded  ferry  collided  with  a  tanker  and  an 
estimated  4,300  people  died.  Although  the  circumstances  of  this  ferry 
sinking  may  be  different  than  those  faced  by  ferries  in  the  United  States, 
they  illustrate  that  an  attack  on  a  crowded  ferry  could  have  dire 
consequences.  The  U.S.  Coast  Guard,  a  component  of  the  Department  of 
Homeland  Security  (DHS),  is  the  lead  federal  agency  responsible  for  a 
wide  array  of  maritime  safety  and  security  activities,  including  those 
involving  ferries  and  their  facilities  under  the  Maritime  Transportation 
Security  Act  of  2002  (MTSA)." 

This  report  is  the  second  of  two  reviewing  the  security  of  high  capacity 
passenger  vessels — ^vessels  capable  of  carrying  500  or  more  passengers. 
The  first  report  focused  on  cruise  ship  and  cruise  ship  facility  security  and 
was  issued  in  April  2010.'‘  The  report  found  that  while  governmental 
agencies,  cruise  ship  operators,  and  other  maritime  security  stakeholders 
have  taken  significant  steps  to  protect  against  a  possible  terrorist  attack, 
the  U.S.  Customs  and  Border  Protection  (CBP) — ^the  federal  agency 
primarily  responsible  for  border  security — should  consider  obtaining 
additional  information  about  cruise  ship  passengers  to  enhance  its 
screening  process.  This  report  focuses  on  the  security  issues  of  high 
capacity  passenger  ferries  and  their  facilities.'^  While  we  limited  our  review 
to  ferry  systems  that  operate  larger,  high  capacity  passenger  ferries,  these 
systems  often  also  operate  smaller  ferries,  and  according  to  Coast  Guard 
officials,  smaller  ferries  face  similar  security  concerns. 

You  requested  that  we  identify  risks  associated  with  ferries  and  their 
facilities  and  the  measures  being  taken  to  protect  them.®  Specifically,  this 
report  responds  to  the  following  questions: 


Tub.  L.  No.  107-296,  116  Stat.  2064  (2002). 

“GAO,  Maritime  Security:  Varied  Actions  Taken  to  Enhance  Cruise  Ship  Security,  but 
Some  Concerns  Remain,  GAO-10-400  (Washington,  D.C.:  Apr.  9,  2010). 

'*Some  passenger  ferries  may  also  carry  cargo  and/or  vehicles  in  addition  to  passengers. 

®Risk  is  a  function  of  three  elements:  (1)  threat — the  probability  that  a  specific  type  of 
attack  will  be  initiated  against  a  particular  targePcleiss  of  targets,  (2)  vulnerability — the 
probability  that  a  particular  attempted  attack  will  succeed  against  a  particular  target  or 
class  of  targets,  and  (3)  consequence — the  expected  worst  ceise  or  worst  reasonable 
adverse  impact  of  a  successful  attack. 
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•  To  what  extent  has  the  U.S.  Coast  Guard  assessed  risk  related  to  high 
capacity  passenger  ferries  and  their  facilities  in  accordance  with  DHS’s 
guidance,  and  what  are  the  identified  risks? 

•  To  what  extent  have  maritime  security  stakeholders  taken  actions  to 
mitigate  the  potential  risks  to  high  capacity  passenger  ferries  and  their 
facilities,  and  to  implement  applicable  federal  laws,  regulations,  and 
guidance;  and  what  additional  actions,  if  any,  could  enhance  ferry 
security? 

This  is  the  public  version  of  the  report  we  issued  in  October  2010  that 
contained  information  related  to  risks  to  high  capacity  passenger  ferries 
and  efforts  made  to  secure  these  ferries  from  terrorist  attacks.  DHS 
deemed  specific  details  of  ferries,  the  risks  to  ferries,  and  methods  used  by 
the  Coast  Guard  and  others  to  secure  ferries  to  be  sensitive  security 
information,  which  must  be  protected  from  public  disclosure.  Therefore, 
this  report  omits  those  details.  Although  information  provided  in  this 
report  is  more  limited  in  scope,  it  addresses  the  same  questions  as  the 
previously  issued  report.  Also,  the  overall  methodology  used  for  both 
reports  is  the  same.  The  conclusions  and  recommendations  contained  in 
our  October  2010  version  of  this  report  remain  generally  unchanged. 

To  determine  the  extent  to  which  the  Coast  Guard  assessed  the  risks  to 
ferries  and  their  facilities  in  accordance  with  DHS’s  guidance,  and  to 
identify  the  risks  associated  with  ferries  and  their  facilities,  we  reviewed 
relevant  federal  guidance  on  the  use  of  risk  management,  including  DHS’s 
National  Infrastructure  Protection  Plan.^  We  also  reviewed  documents 
describing  the  methodology  and  use  of  the  Coast  Guard’s  primary  risk 
assessment  tool — the  Maritime  Security  Risk  Analysis  Model.  We  analyzed 
the  elements  of  the  Coast  Guard’s  risk  analysis  model  process  and 
compared  it  to  criteria  from  two  components — risk  assessment  and 
prioritization — of  the  National  Infrastructure  Protection  Plan,  the 
document  that  articulates  the  risk  management  framework  for  DHS.  We 
also  analyzed  the  nationwide  results  for  2009  of  the  risk  analysis  model  to 
determine  the  relative  risks  facing  ferries  and  their  facilities.  In  addition, 
we  interviewed  Coast  Guard  headquarters  personnel  responsible  for  the 


The  National  Infrastructure  Protection  Plan  provides  the  unifying  structure  and  overall 
framework  for  the  integration  of  critical  infrastructure  and  key  resource  protection  into  a 
single  national  program. 
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risk  analysis  model  and  Coast  Guard  Sector  personnel  responsible  at  the 
local  level  to  discuss  the  relative  risks  in  their  areas  of  responsibility/ 

In  addition,  we  interviewed  Coast  Guard  and  U.S.  Navy  intelligence 
personnel  actively  engaged  in  determining  possible  threats  to  ferries  and 
their  facilities.  We  also  interviewed  Coast  Guard,  CBP,  and  U.S.  Park 
Police  officials,  as  well  as  personnel  from  seven  nonfederal  law 
enforcement  agencies.  The  Coast  Guard  and  CBP  officials  were  those 
responsible  for  ferry  and  ferry  facility  security  at  both  the  national  level 
and  at  the  locations  where  we  made  site  visits.  Similarly,  the  law 
enforcement  personnel  we  met  with  represented  jurisdictions  covered  in 
our  site  visits  where  they  provided  security  for  ferries  and  their  facilities. 
We  made  these  visits  to  a  nonprobability  sample  of  five  domestic 
locations.  Ferry  operations  at  these  locations  are  overseen  by  five  Coast 
Guard  Sectors.'*  We  selected  these  locations  based  on  the  number  of 
passengers  carried  by  the  ferry  systems  operating  in  these  locations  and 
the  relative  risk  associated  with  the  ferry  systems.  We  also  selected 
locations  that  had  domestic  and  international  ferries.  While  the 
information  we  obtained  from  personnel  at  these  locations  cannot  be 
generalized  across  all  U.S.  ferry  systems,  it  provided  us  with  a  perspective 
on  the  risks  to  ferries  and  their  facilities  at  the  selected  locations.  While 
their  views  may  not  represent  the  views  of  all  high  capacity  passenger 
ferry  operators,  these  ferry  systems  represented  about  70  percent  of 
passengers  and  about  80  percent  of  vehicles  carried  by  U.S.  ferry 
operators  that  in  2008  reported  that  they  had  vessels  in  service  capable  of 
carrying  500  or  more  passengers. 

To  determine  the  extent  to  which  maritime  security  stakeholders — 
including  federal  agencies,  ferry  and  ferry  facility  operators,  and  law 
enforcement  agencies — have  taken  actions  to  mitigate  the  potential  risks 
to  ferries  and  their  facilities  and  to  implement  applicable  federal  laws. 


“Coast  Guard  Sectors  run  all  Coast  Guard  missions  at  the  local  and  port  level,  such  as 
search  and  rescue,  port  security,  environmental  protection,  and  law  enforcement  in  ports 
and  surrounding  waters,  and  oversee  a  number  of  smaller  Coast  Guard  units,  including 
small  cutters,  small  boat  stations,  and  Aids  to  Navigation  teams.  The  Coast  Guard  is  divided 
into  35  Sectors. 

“At  these  five  locations,  we  made  observations  of  six  ferry  systems.  Two  of  the  locations 
also  received  international  ferries.  In  addition  to  the  Coast  Guard,  we  interviewed  a  total  of 
eight  federal,  state,  or  local  law  enforcement  agencies;  seven  ferry  operators  or  port 
authorities;  and  one  Area  Maritime  Security  Committee  chair  at  these  locations;  and  one 
CBP  unit  at  a  foreign  port. 
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regulations,  and  guidance,  we  reviewed  relevant  federal  legislation, 
regulations,  and  guidance.  These  included  pertinent  provisions  of  MTSA, 
as  amended,  including  the  Security  and  Accountability  For  Every  Port  Act 
of  2006  (SAFE  Port  Act)  amendments  to  MTSA;  implementing 
regulations — such  as  33  CFR  Parts  101,  102,  103, 104,  and  105;  the  Coast 
Guard’s  Operation  Neptime  Shield  operations  order;  Navigation  and  Vessel 
Inspection  Circulars;  and  Maritime  Security  Directives,  respectively.  We 
analyzed  data  on  the  Coast  Guard’s  security  performance  in  meeting 
internal  standards  established  for  Operation  Neptune  Shield  during  2009, 
and  on  ferry  and  ferry  facility  operator’s  security  performance  in  meeting 
requirements  identified  in  Coast  Guard  regulations  from  2006  to  2009.  We 
found  these  data  to  be  sufficiently  reliable  for  the  purpose  of  providing 
contextual  or  background  information.  To  make  this  determination  we 
conducted  interviews  with  knowledgeable  agency  officials  and  performed 
data  testing  for  missing  data,  outliers,  and  obvious  errors.  We  also 
interviewed  federal  officials  from  various  agencies,  including  the  Coast 
Guard,  CBP,  and  U.S.  Park  Police  to  discuss  their  actions  to  reduce  risks 
to  ferries  and  their  facilities.  We  observed  security  activities  and 
interviewed  law  enforcement  personnel  from  seven  nonfederal  police 
departments  responsible  for  protecting  ferries  and  their  facilities  from 
terrorist  attacks  at  the  domestic  locations  we  visited.  As  part  of  our 
observations  of  security  measures,  we  traveled  aboard  international  and 
domestic  ferries  at  these  locations.  While  our  observations  at  these 
locations  cannot  be  generalized  across  all  U.S.  ports,  they  provided  us 
with  a  general  overview  and  perspective  on  ferry  and  ferry  facility  security 
at  the  selected  locations.  We  also  made  a  site  visit  to  one  foreign  location 
where  a  major  high  capacity  ferry  system  operated  to  observe  possible 
security  actions  other  than  those  used  in  the  United  States.  Although  this 
location  does  not  represent  all  international  locations  with  high  capacity 
passenger  ferry  operators,  we  selected  this  location  because  Coast  Guard 
officials  stated  that  this  ferry  system  was  similar  to  one  of  the  larger 
systems  in  the  United  States  and  would  serve  as  a  good  comparison  to  U.S. 
ferry  systems.  We  also  reviewed  three  Coast  Guard-funded  reports  issued 
in  2005  and  2006  on  ferry  security  to  determine  what  actions  the  reports 
recommended  that  the  Coast  Guard  take  to  help  ensure  ferry  security.  We 
interviewed  Coast  Guard  officials  to  determine  what  actions  had  been 
taken  in  response  to  these  reports.  We  also  reviewed  the  scope  and 
methodology  for  these  reports  and  determined  they  were  sufficient  for  us 
to  rely  on  for  the  purposes  of  this  report. 
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We  conducted  this  performance  audit  from  January  2009  to  December 
2010  in  accordance  with  generally  accepted  government  auditing 
standards.  Those  standards  require  that  we  plan  and  perform  the  audit  to 
obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for 
our  findings  and  conclusions  based  on  our  audit  objectives.  We  believe 
that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings 
and  conclusions  based  on  our  audit  objectives. 


Background 


Ferries  Transport  According  to  the  190  ferry  operators  responding  to  the  2008  National 

Passengers  and  Vehicles  Census  of  Ferry  Operators,  more  than  82  million  passengers  and  over  25 

million  vehicles  were  carried  on  their  vessels  in  the  United  States.  “  As 
reported  in  2008,  the  ferry  systems  that  carried  the  most  passengers  and 
vehicles  in  2008  were  the  New  York  City  Department  of  Transportation 
Ferry  Division  (Staten  Island  Ferry)  which  carried  19  million  passengers, 
but  no  vehicles,  and  the  Washington  State  Ferries  that  carried  over  13 
million  passengers  and  almost  11  million  vehicles.  In  addition,  California, 
Louisiana,  Massachusetts,  New  Jersey,  North  Carolina,  Ohio,  Texas,  and 
Virginia  all  had  ferry  systems  that  carried  over  1  million  passengers.  See 
figure  1  for  a  map  identifying  the  states  where  ferry  systems  operate 
vessels  that  can  carry  500  or  more  passengers,  as  well  as  the  number  of 
passengers  and  vehicles  carried  by  these  systems.  In  addition  to  the  ferries 
that  operate  solely  inside  the  United  States,  CBP  identified  28  ferries  that 
sailed  in  2009  to  the  United  States  from  a  port  in  Canada,  Mexico,  the 
British  Virgin  Islands,  or  the  Dominican  Republic. 


“During  this  time,  we  were  concurrently  working  on  another  passenger  vessel  security 
report,  issued  in  April  2010;  see  GAO-10-400.  In  addition,  we  were  also  developing  the 
sensitive  version  of  this  ferry  security  report,  issued  in  October  2010. 

“U.S.  Department  of  Transportation,  Research  and  Innovative  Technology  Administration, 
Bureau  of  Transportation  Statistics,  National  Census  of  Ferry  Operators  2008, 
http://www.transtats.bts.gov/tables.asp?DB_lD=616&DB_Name=&DB_Short_Name 
(Accessed  May  21,  2010). 
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Figure  1 :  2008  National  Census  Data  on  States  with  Ferry  Systems  Operating  High  Capacity  Passenger  Ferries  and  the 
Number  of  Passengers  and  Vehicles  Carried 


Note:  This  graphic  is  based  on  data  reported  by  the  Bureau  of  Transportation  Statistics  in  the  2008 
Nationai  Census  of  Ferry  Operators.  These  data  inciuded  seif-reported  data  to  the  census  by  the 
responding  ferry  systems,  aiong  with  information  obtained  from  agencies  such  as  the  Coast  Guard 
and  the  Army  Corps  of  Engineers.  As  reported  by  the  Bureau  of  Transportation  Statistics,  data  was 
not  avaiiabie  for  aii  questions  for  aii  systems.  For  exampie,  the  reported  data  for  one  system  in 
Louisiana  inciuded  that  it  operated  high  capacity  passenger  ferries,  but  did  notinciude  the  totai 
number  of  passengers  it  carried.  That  system  is  not  inciuded  in  figure  1.  Of  the  systems  inciuded  in 
the  census,  data  show  that  29  operated  ferries  capabie  of  carrying  500  or  more  passengers.  Twenty- 
eight  of  these  29  ferry  systems  operate  in  the  11  states  highiighted  in  figure  1  above.  No  systems 
reported  operating  ferries  capabie  of  carrying  500  or  more  passengers  in  Aiaska  or  Hawaii. 
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Many  Stakeholders 
Involved  in  Securing  Ferry 
Operations 


Numerous  organizations  play  a  role  in  the  security  of  ferries  operating  in 
U.S.  waters.  Table  1  lists  selected  federal  agencies  and  other  stakeholders 
together  with  examples  of  the  ferry-related  maritime  security  activities 
that  they  conduct. 


Table  1 :  Selected  Stakeholders  with  Security  Responsibilities  Applicable  to  Ferries 


Stakeholders 

Selected  maritime  security-related 
responsibilities 

International  organization 

•  International  Maritime 
Organization® 

• 

Develop  international  standards  for  port  and 
vessel  security. 

Federal  government:  Department  of  Homeland  Security 

•  U.S.  CoastGuard 

Conduct  vessel  escorts,  boardings  of  selected 
vessels,  and  security  patrols  of  key  port  areas. 

Ensure  vessels  in  U.S.  waters  comply  with 
domestic  and  international  maritime  security 
standards. 

Review  U.S.  vessel  and  facility  security  plans 
and  oversee  compliance  with  these  plans. 

•  Transportation  Security 
Administration  (TSA) 

Testtechnologies,  practices,  and  techniques 
for  passenger  screening  systems  in  the 
maritime  environment. 

Coordinate  with  the  CoastGuard  on  security 
training  and  surge  operations. 

•  U.S.  Customs  and  Border 
Protection  (CBP) 

Review  documentation  of  persons,  baggage, 
and  cargo  arriving  from  foreign  ports  on 
international  ferries. 

Take  action  to  deny  entrance  to  the  United 
States  if  concerns  about  persons,  baggage,  or 
cargo  exist. 

State  and  local  governments 

•  Law  enforcement  agencies 

• 

Often  act  as  land-based  security  for  ferry 
operators. 

• 

Support  Coast  Guard  role  through  water 
patrols  and  possibly  escort  vessels  if  the 
agency  operates  a  marine  unit. 

•  State  and  city  Departments  of 
Transportation  and  Port 
Authorities 

• 

Own  many  ferry  systems  and  thus  assume 
responsibility  for  ensuring  their  security  by 
conducting  vulnerability  assessments  and 
developing  and  implementing  security  plans  to 
mitigate  vulnerabilities  and  comply  with 
applicable  international  and  domestic 
standards. 

• 

Conduct  risk-mitigating  actions  including 
maintaining  secure  areas  and  screening 
passengers  and  vehicles. 
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Stakeholders 

Selected  maritime  security-related 
responsibilities 

Private  sector 

•  Private  owners  or  operators 

•  Own  or  operate  many  ferry  systems  and  thus 
assume  responsibiiity  for  ensuring  their 
security  by  conducting  vuinerabiiity 
assessments  and  deveioping  and 
impiementing  security  pians  to  mitigate  the 
vuinerabiiities  and  compiy  with  applicabie 
internationai  and  domestic  standards. 

•  Conduct  risk-mitigating  actions  inciuding 
maintaining  secure  areas  and  screening 
passengers  and  vehicies. 

•  Security  contractors 

•  Provide  security  services  at  ferry  faciiities. 

Source:  GAO. 


“The  International  Maritime  Organization  is  a  specialized  agency  of  the  United  Nations  with  169 
member  states  that  is  responsible  for  developing  an  international  regulatory  framework  addressing, 
among  other  things,  maritime  safety  and  security. 


Maritime  Security  Actions  International  standards  and  national  laws,  regulations,  and  guidance  direct 
Are  Guided  by  a  Legal  and  federal  agencies  and  vessel  and  facility  operators  nationwide  in  their 
Regulatory  Framework  security  efforts  (see  table  2). 


Tabie  2:  Key  Security  Requirements  Applicable  to  Ferries  and  Ferry  Facilities 

Promulgator 

Law  or  guidance 

Key  provisions 

internationai  Maritime 
Organization 

internationai  Ship  and  Port  Faciiity 
Security  (iSPS)  Code,"  as  impiemented 
through  ChapterXi-2  ofthe  internationai 
Convention  for  the  Safety  of  Life  at  Sea" 

Sets  out  many  of  the  internationai  standards  for  vessei  and 
port  faciiity  security.  For  exampie,  aii  covered  vesseis  shaii 
have  a  designated  security  officer. 

U.S.  Federai  Government 

Maritime  T ransportation  Security  Act  of 
2002  (MTSAf 

Estabiishes  a  maritime  security  framework  inciuding  many  of 
the  U.S.  vessei  and  port  faciiity  security  requirements  and 
standards  and  for  Coast  Guard  enforcement  of  many  of  such 
provisions.  One  such  provision,  for  exampie,  requires 
reguiated  faciiities  and  vesseis  to  have  vuinerabiiity 
assessments. 

SAFE  Port  Act  amendments  to  MTSA 
(2006)" 

Sets  additionai  requirements  forCoastGuard  reguiation  of 
port  faciiity  security.  For  exampie,  at  ieast  one  security 
inspection  to  verity  the  effectiveness  of  a  reguiated  faciiity 
security  pian  shaii  be  unannounced. 
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Promulgator 

Law  or  guidance 

Key  provisions 

CoastGuard 

Implementing  Regulations  (such  as  33 
C.F.R.  Parts  101, 104,  and  105) 

Based  on  legislative  authority,  set  specific  security 
requirements  forU.S.  flagged  vessels  and  port  facilities.  For 
example,  owners  or  operators  of  ferries  must  ensure  that 
security  sweeps  ofthe  vessel  are  performed  before  getting 
underway. 

Operation  Neptune  Shield  Operations 
Order 

Sets  internal  CoastGuard  standards  for  vessel  (including 
ferries)  security  activities,  which  include  escorts  and  security 
boardings—  boardings  performed  to  verify  that  the  ship  and 
crew  are  operating  as  expected  and  to  acton  intelligence  that 
may  have  prompted  security  concerns.  For  example.  Coast 
Guard  units  are  required  to  escort  a  certain  percentage  of 
high  capacity  passenger  vessels  under  different  Maritime 
Security  threat  levels.'  (Specific  percentages  are  classified.) 
Operation  Neptune  Shield  activities  are  based  on  an 
understanding  of  maritime  risk  and  mitigation. 

Navigation  and  Vessel  Inspection 
Circulars 

Provide  CoastGuard  guidance  about  the  enforcement  of,  or 
compliance  with,  certain  federal  maritime  regulations  and 
CoastGuard  maritime  safety  and  security  programs.  For 
example,  these  state  how  CoastGuard  inspectors  are  to 
ensure  operators'  compliance  with  higher  standards  for 
passenger  screening  and  security  sweeps  on  ferries. 

Maritime  Security  Directives 

Set  security  performance  standards  for  stakeholders 
responsible  for  taking  security  actions  commensurate  with 
various  Maritime  Security  threat  levels.  For  example,  one 
standard  includes  the  varying  percentages  of  vehicles  to  be 
screened  before  boarding  ferries  under  different  Maritime 
Security  threat  levels. 

Source:  GAO. 


“IMO  Doc.  SOLAS/CONF.  5/34  (Dec.  12,  2002). 

‘’32  U.S.T.  47,  T.I.A.S.  No.  9700. 

‘Pub.  L.  No.  107-295,  116  Stat.  2064  (2002). 

“Pub.  L.  No.  109-347,  120  Stat.  1884  (2006). 

“Maritime  Security  threat  ieveis  are  a  three-tiered  (Maritime  Security  Levei  1,  Maritime  Security  Levei 
2,  and  Maritime  Security  Levei  3)  threatwarning  system  to  provide  a  means  to  easiiy  communicate 
prepianned  scaiabie  responses  to  increased  threat  ieveis.  They  are  set  by  the  Coast  Guard,  in 
consuitation  with  DHS,  to  reflect  the  prevaiiing  threat  environment  to  the  marine  eiements  of  the 
nationai  transportation  system,  inciuding  ports,  vesseis,  faciiities,  and  criticai  assets  and  infrastructure 
iocated  on  oradjacentto  waters  subject  to  the  jurisdiction  ofthe  United  States.  For  the  purpose  of 
these  requirements,  the  CoastGuard  defines  high  capacity  passenger  vesseis  as  those  carrying  500 
or  more  passengers. 
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Risk  Management  Is 
Important  for  Maritime 
Security 


DHS  is  required  by  statute  to  utilize  risk  management  principles  with 
respect  to  various  DHS  functions.  In  2006,  DHS  issued  the  National 
Infrastructure  Protection  Plan,  which  is  DHS’s  base  plan  that  guides  how 
DHS  and  other  relevant  stakeholders  should  use  risk  management 
principles  to  prioritize  protection  activities  in  an  integrated  and 
coordinated  fashion.  Updated  in  2009,  the  National  Infrastructure 
Protection  Plan  requires  that  federal  agencies  use  relative  risk  to  inform 
the  selection  of  priorities  and  the  continuous  improvement  of  security 
strategies  and  programs  to  protect  people  and  critical  infrastructure  by 
reducing  the  risk  of  acts  of  terrorism.  The  framework  for  the  plan  includes 
six  components:  (1)  set  goals  and  objectives;  (2)  identify  assets,  systems, 
and  networks;  (3)  assess  risk;  (4)  prioritize;  (5)  implement  programs;  and 
(6)  measure  effectiveness. 

In  the  assess  risk  component,  the  National  Infrastructure  Protection  Plan 
establishes  baseline  criteria  for  conducting  risk  assessments.  According  to 
the  National  Infrastructure  Protection  Plan,  risk  assessments  are  a 
qualitative  or  quantitative  determination  of  the  likelihood  of  an  adverse 
event  occurring  and  are  a  critical  element  of  the  National  Infrastructure 
Protection  Plan’s  risk  management  framework.  Risk  assessments  can  also 
help  decision  makers  identify  and  evaluate  potential  risks  so  that 
countermeasures  can  be  designed  and  implemented  to  prevent  or  mitigate 
the  potential  effects  of  the  risks.  The  National  Infrastructure  Protection 
Plan  also  characterizes  risk  assessment  as  a  function  of  three  elements: 

•  Threat:  The  likelihood  that  a  particular  asset,  system,  or  network  will 
suffer  an  attack  or  an  incident.  In  the  context  of  risk  associated  with  a 
terrorist  attack,  the  estimate  of  threat  is  based  on  the  analysis  of  the 
intent  and  the  capability  of  an  adversary;  in  the  context  of  a  natural 
disaster  or  accident,  the  likelihood  is  based  on  the  probability  of 
occurrence. 

•  Vulnerability:  The  likelihood  that  a  characteristic  of,  or  flaw  in,  an 
asset’s,  system’s,  or  network’s  design,  location,  security  posture, 
process,  or  operation  renders  it  susceptible  to  destruction. 


‘Tor  example,  the  Homeland  Security  Act  of  2002  (Pub.  L.  No.  107-296,  §201,  116  Stat.  2135, 
2146  (2002))  requires  DHS  to  perform  risk  assessments  of  key  resources  and  critical 
infrastructure,  and  the  Intelligence  Reform  and  Terrorism  Prevention  Act  of  2004  (Pub.  L. 
No.  108-458,  §4001,  118  Stat.  3638,  3710  (2004))  requires  that  DHS’s  National  Strategy  for 
Transportation  Security  include  the  development  of  risk-based  priorities  across  all 
transportation  modes. 
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incapacitation,  or  exploitation  by  terrorist  or  other  intentional  acts, 
mechanical  failures,  and  natural  hazards. 

•  Consequence:  The  negative  effects  on  public  health  and  safety,  the 
economy,  public  confidence  in  institutions,  and  the  functioning  of 
government,  both  direct  and  indirect,  that  can  be  expected  if  an  asset, 
system,  or  network  is  damaged,  destroyed,  or  disrupted  by  a  terrorist 
attack,  natural  disaster,  or  other  incident. 

Information  from  the  three  elements  that  assess  risk — threat,  vulnerability, 
and  consequence — can  lead  to  a  risk  characterization  and  provide  input 
for  prioritizing  security  goals — the  fourth  component  within  the 
framework.  For  example,  MTSA  requires  the  Coast  Guard  to  prepare  Area 
Maritime  Transportation  Security  Plans  for  ports  around  the  United  States. 
These  plans  convey  operational  and  physical  security  measures, 
communications  procedures,  time  frames  for  responding  to  security 
threats,  and  other  actions  to  direct  the  prevention  of  and  response  to  a 
security  incident.  In  its  regulations  implementing  MTSA,  the  Coast  Guard 
gave  primary  responsibility  for  creating  the  Area  Maritime  Security  Plans 
to  the  Captain  of  the  Port,  based  on  the  Area  Maritime  Security 
Assessment.  “  Area  Maritime  Security  Assessments  examine  the  threats 
and  vulnerabilities  to  activities,  operations,  and  infrastructure  critical  to  a 
port  and  the  consequences  of  a  successful  terrorist  attack  on  the  critical 
activities,  operations,  and  infrastructure  at  the  port.  Under  the  regulations, 
such  assessments  are  to  be  risk-based,  and  should  assess  each  potential 
threat  and  the  consequences  and  vulnerabilities  for  each  combination  of 
targets  and  attack  modes  in  the  area.  With  the  information  supplied  in  the 
assessment,  the  Area  Maritime  Security  Plan  is  to  identify,  among  other 
things,  the  operational  and  physical  security  measures  to  be  implemented 
at  Maritime  Security  Level  1  and  those  that,  as  risks  increase,  will  enable 
the  area  to  progress  to  levels  2  and  3.  According  to  the  Coast  Guard, 
procedures  and  measures  conveyed  in  Area  Maritime  Security  Plans  are 
coordinated,  communicated,  and  implemented  by  the  Captain  of  the  Port 
with  stakeholder  communication  assistance  from  Area  Maritime  Security 
Committees,  using  existing  agency  command  and  control  systems,  and 
when  activated,  unified  incident  management  structures. 


“The  Captain  of  the  Port  is  the  Coast  Guard  officer  designated  by  the  Commandant  to 
enforce  within  his  or  her  respective  areas  port  seifety  and  security  and  marine 
environmental  protection  regulations,  including,  without  limitation,  regulations  for  the 
protection  and  security  of  vessels,  harbors,  and  waterfront  facilities. 
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The  Coast  Guard 
Assessed  Risk  to 
Ferries  and  Their 
Facilities  in 
Accordance  with 
DHS’s  Risk 

Assessment  Guidance 
and  Security 
Concerns  Exist 


The  Coast  Guard  Adheres 
to  Risk  Assessment 
Guidance  from  DHS’s 
National  Infrastructure 
Protection  Plan 


The  Coast  Guard  uses  a  tool  known  as  the  Maritime  Security  Risk  Analysis 
Model  to  assess  risk  to  vessels  and  port  infrastructure,  including  ferries 
and  ferry  facilities,  in  accordance  with  the  guidance  from  DHS’s  National 
Infrastructure  Protection  Plan.  As  we  reported  in  April  2010,  the  Coast 
Guard  uses  this  analysis  tool  to  help  implement  its  strategy  and 
concentrate  maritime  security  activities  when  and  where  relative  risk  is 
believed  to  be  the  greatest.  “  The  model  assesses  the  risk — threats, 
vulnerabilities,  and  consequences — of  a  terrorist  attack  based  on  different 
scenarios;  that  is,  it  combines  potential  targets  with  different  means  of 
attack.  Examples  of  a  Maritime  Security  Risk  Analysis  Model  scenario 
related  to  ferries  include  those  involving  a  suicide  bomber  or  a  boat 
attack.  Taking  threats,  vulnerabilities,  and  consequences  into 
consideration  is  the  approach  to  assessing  risk  recommended  by  the 
National  Infrastructure  Protection  Plan.  According  to  the  Coast  Guard,  the 
model’s  underlying  methodology  is  designed  to  capture  the  security  risk 
facing  different  types  of  targets,  allowing  comparison  between  different 
targets  and  geographic  areas  at  the  local,  regional,  and  national  levels. 

Also  in  accordance  with  guidance  from  the  National  Infrastructure 
Protection  Plan,  the  model  is  designed  to  support  decision  making  for  the 
Coast  Guard.  At  the  national  level,  the  model’s  results  are  used  for  (1) 
long-term  strategic  resource  plarming,  (2)  identifying  capabihties  needed 
to  combat  future  terrorist  threats,  and  (3)  identifying  the  highest-risk 
scenarios  and  targets  in  the  maritime  domain.  At  the  local  level,  the 
Captain  of  the  Port  can  use  the  model  as  a  tactical  plarming  tool,  and  it  can 


“GAO- 10-400. 
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help  to  identify  the  highest-risk  scenarios,  allowing  the  Captain  of  the  Port 
to  prioritize  needs  and  better  deploy  security  assets.  As  we  reported  in 
March  2009,  Intelligence  Coordination  Center  officials  stated  that  the 
Coast  Guard  uses  the  model  to  inform  allocation  decisions,  such  as  the 
deployment  of  local  resources  and  grants.  “ 


Although  No  Recent 
Threats  Have  Been 
Identified,  Stakeholders 
Reported  Security 
Concerns 


Although  there  have  been  no  recent,  credible  terrorist  threats  against 
ferries  and  their  facilities  in  the  United  States,  stakeholders  expressed 
concerns  about  various  types  of  attacks  that,  if  successful,  could  have 
significant  consequences.  Since  the  characteristics  and  operations  of  the 
ferry  systems  vary  widely,  different  operations  and  ferry  system 
components  face  different  levels  of  threats  with  different  probabilities  of 
occurrence.  In  April  2010,  Coast  Guard  intelligence  officials  stated  that 
there  have  been  no  credible  terrorist  threats  against  ferries  and  their 
facilities  identified  in  at  least  the  last  12  months,  but  noted  the  presence  of 
terrorist  groups  that  have  the  capability  to  attack  a  ferry.  Further,  the  lack 
of  a  recent  threat  does  not  preclude  the  possibility  of  such  an  incident 
occurring  in  the  future.  As  reported  both  by  the  Coast  Guard  and  RAND, 
ferries  have  been  terrorist  targets  in  the  past  and  are  considered  attractive 
targets  for  terrorists.  In  2006,  the  Transportation  Research  Board  reported 
that  the  same  characteristics  that  make  ferry  systems  desirable  to 
passengers — the  wide  extent  of  service  and  the  popularity  of  use — also 
make  them  potential  targets  and  potential  instruments  of  a  terrorist  act.  “ 
As  we  previously  reported  in  2007,  security  officials  in  the  U.S. 
government  are  concerned  about  the  possibility  of  a  future  terrorist  attack 
in  a  U.S.  port.'^  For  example,  captured  terrorist  training  manuals  cite  ports 
as  targets  and  instruct  trainees  to  use  covert  means  to  obtain  surveillance 
information  for  use  in  attack  planning.  Terrorist  leaders  have  also  stated 
their  intent  to  attack  infrastructure  targets  within  the  United  States, 
including  ports,  in  an  effort  to  cause  physical  and  economic  damage  and 
inflict  mass  casualties.  In  April  2010,  Coast  Guard  intelligence  officials  also 


“For  more  information  on  risk  assessment  models  used  in  the  aviation  transportation 
mode,  see  GAO,  Transportation  Security:  Comprehensive  Risk  Assessments  and  Stronger 
Internal  Controls  Needed  to  Help  Inform  TSA  Resource  Allocation,  GAO-09-492 
(Washington  D.C.:  Mar.  27,  2009). 

“Transportation  Research  Board’s  Transit  Cooperative  Research  Program,  Security 
Measures  for  Ferry  Systems  (Washington,  D.C.:  2006). 

“GAO,  Maritime  Security:  Federal  Efforts  Needed  to  Address  Challenges  in  Preventing 
and  Responding  to  Terrorist  Attacks  on  Energy  Commodity  Tankers,  GAO-08-141 
(Washington,  D.C.:  Dec.  10,  2007). 
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stated  that  they  have  seen  a  gradual  shift  in  terrorist  tactics  and 
procedures  overseas  that  had  been  seen  in  attacks  against  mass  transit 
and  other  soft  targets — characteristics  typically  shared  with  ferry  systems 
as  well. 


Stakeholders  Reported  Maritime  security  stakeholders  reported  various  ferry-related  security 

Various  Security  Concerns  concerns  with  the  greatest  concerns  being  improvised  explosive  device 

attacks  delivered  via  vehicles,  passengers  or  small  boats.  Vehicle-bome 
improvised  explosive  device  concerns,  for  ferry  operations  that  carry 
vehicles,  included  concerns  about  devices  carried  in  cars  and  trucks.  Our 
work  from  February  2009  supports  the  likely  validity  of  this  concern  as 
vehicle-borne  improvised  explosive  devices  were  the  most  common  tactic 
used  in  truck  and  bus  terrorist  incidents  abroad.^**  However,  not  all  ferry 
systems  allow  vehicles  on  board.  Coast  Guard  officials  we  interviewed 
expressed  concern  about  passenger-borne  improvised  explosive  devices 
on  ferries  as  well — such  as  a  passenger  carrying  a  bomb  in  a  backpack. 
Determining  passengers’  identities,  through  admissibility  inspections,  is 
one  type  of  action  that  CBP  has  taken  to  help  mitigate  concerns  posed  by 
passengers  boarding  ferries  that  originate  from  Canada.'®  Nonetheless, 
according  to  CBP  officials,  CBP  persormel  do  not  know  a  person’s  identity 
until  he  or  she  arrives  at  the  facility  to  board.  However,  Coast  Guard 
officials  stated  that  ferry  operators  may  see  the  same  people  over  and  over 
again  and  can  become  familiar  with  the  regular  passengers.  Maritime 
security  stakeholders  also  consider  waterborne  improvised  explosive 
devices  to  be  a  concern  for  ferries  and  their  facihties.  According  to  the 
Coast  Guard’s  Strategy  for  Maritime  Safety,  Security,  and  Stewardship,  one 
of  the  greatest  risks  associated  with  maritime  scenarios  is  a  direct  attack 
using  a  waterborne  improvised  explosive  device,  and  a  recurring  attack 
mode  has  been  the  use  of  small  boats  to  carry  out  an  attack. 

Port  security  stakeholders  we  interviewed  also  reported  other  ferry- 
related  security  concerns — some  of  which  were  more  port  specific.  For 
example,  international  ferries  pose  an  additional  concern  by  providing  a 


“GAO,  Commercial  Vehicle  Security:  Risk-Based  Approach  Needed  to  Secure  the 
Commercial  Vehicle  Sectors,  GAO-09-85  (Washington,  D.C.:  Feb.  27,  2009). 

“Admissibihty  inspections  are  conducted  to  determine  the  nationality  and  identity  of  each 
person  wishing  to  enter  the  United  States  and  to  prevent  the  entry  of  inadmissible  aliens, 
including  those  thought  to  be  criminals,  terrorists,  or  drug  traffickers.  In  this  example,  the 
inspection  would  be  conducted  while  the  ferry  is  stUl  in  a  Canadian  port. 
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possible  transit  for  terrorists  to  enter  the  United  States  as  exemplified  by 
the  1999  millennium  bomber,  who  traveled  to  the  United  States  on  a  ferry 
from  Canada  and  had  planned  to  bomb  the  Los  Angeles  International 
Airport.  Port  security  stakeholders  reported  other  security  concerns 
including  criminal  activity,  such  as  drug  or  human  smuggling,  particular  to 
where  their  ferries  transit. 


A  Successful  Attack  Could 
Have  Significant 
Consequences 


A  successful  attack  on  a  ferry  could  affect  the  ship,  its  passengers,  and  the 
U.S.  economy.  A  successful  attack  could  damage  a  ferry  and  the  extent  of 
the  loss  of  life  would  depend  on  the  severity  of  the  attack,  according  to 
various  studies.  A  2006  RAND  report  stated  that  scenarios  involving 
significant  damage  could  easily  result  in  several  hundred  fatalities  and  the 
greater  the  damage,  the  more  likely  it  would  be  that  the  vessel  would  sink 
resulting  in  a  higher  death  toll. 


A  successful  terrorist  attack  on  a  ferry  system  may  also  have  an  economic 
impact.  Coast  Guard  officials  stated  that  an  attack  on  a  ferry  could  target  a 
lot  of  people  at  one  time  and  shut  down  port  operations,  which  could 
ultimately  have  an  economic  ripple  effect.  Coast  Guard  officials  differed  in 
their  opinions,  however,  on  whether  a  ferry  attack  would  likely  have  a 
national  economic  impact  or  if  the  economic  impact  would  be  more 
localized,  but  agreed  that  it  would  depend  on  the  scenario.  Furthermore, 
the  reaction  to  an  attack  on  a  ferry  could  also  affect  the  degree  of  the 
economic  impact.  According  to  the  Coast  Guard  and  RAND,  ferry  transit  is 
largely  a  substitutable  form  of  transportation  for  which  passengers  may 
opt  to  use  another  form  of  transportation,  such  as  a  bridge,  following  an 
attack,  and,  therefore,  the  economic  impact  of  such  an  action  may  not 
necessarily  be  significant.  However,  an  attack  on  a  ferry  could  also  result 
in  additional  funding  spent  on  enhanced  security  measures.  For  example, 
the  2004  attack  against  the  SuperFerry  14  in  the  Philippines  affected 
perceived  terrorist  threat  contingencies  and  was  a  central  factor  in 
subsequent  decisions  to  deploy  sea  marshals  on  all  ships  traveling  in 
Philippine  waters  as  well  as  promulgate  heightened  surveillance, 
investigation,  arrest,  and  detention  powers  for  the  police  and  intelligence 
services. 
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Stakeholders  Have 
Implemented  Ferry 
Security  Measures, 
but  the  Coast  Guard 
Has  Not  Acted  on 
Other  Identified 
Opportunities  That 
May  Enhance  Security 


To  secure  ferries  and  their  facilities,  responsible  maritime  security 
stakeholders — including  the  Coast  Guard,  CBP,  and  TSA,  as  well  as 
owners  and  operators  of  ferries  and  their  facilities — reported  having  taken 
various  actions  to  implement  applicable  federal  maritime  laws, 
regulations,  and  guidance  designed  to  help  ensure  the  security  of  ferries 
and  their  facilities. 


The  Coast  Guard  Reports 
That  It  Conducts  Multiple 
Types  of  Security  Activities 


The  Coast  Guard  seeks  to  mitigate  risks  to  ferries  and  their  facilities 
through  regulatory  and  operational  activities.  The  Coast  Guard’s 
regulatory  activity  involves  ferry  and  ferry  facility  inspections,  conducted 
by  inspections  teams  who  monitor  compliance  with  operators’  security 
plans. According  to  Coast  Guard  officials,  the  Coast  Guard  conducts 
inspections  of  ferries  four  times  per  year:  the  annual  security  inspection, 
which  may  be  combined  with  a  safety  inspection  and  typically  occurs 
when  the  ferry  is  out  of  service,  and  the  quarterly  inspections,  which  are 
shorter  in  duration,  and  generally  take  place  while  the  ferry  remains  in 
service.  During  calendar  years  2006  through  2009,  the  Coast  Guard 
reported  conducting  over  1,600  ferry  inspections — about  670  of  which 
were  for  high  capacity  passenger  ferries.  Coast  Guard  officials  stated  that 
although  ferry  operators  are  responsible  for  scheduling  inspections  as  a 
condition  of  their  certification,  the  Coast  Guard  has  a  system  in  place  to 
notify  the  agency  if  a  ferry’s  certification  has  expired  so  that  the  Coast 
Guard  may  act  accordingly. 


In  addition  to  ferry  vessel  inspections,  the  Coast  Guard  reports  that  it 
inspects  MTSA-regulated  maritime  facilities,  including  ferry  facilities,  at 


“MTSA  and  its  implementing  regulations  require  that  ferry  and  ferry  facility  operators 
develop  security  plans  and  that  the  Coast  Guard  review  and  approve  these  plans  to  ensure 
they  are  sufficient  to  mitigate  identified  vulnerabilities  and  that  stakeholders  are  complying 
with  them. 
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least  two  times  a  year  in  accordance  with  SAFE  Port  Act  requirements.^* 
One  of  these  inspections  must  be  unannounced.  The  Coast  Guard  reported 
conducting  between  approximately  700  and  850  ferry  facility  inspections 
each  calendar  year  for  the  period  2006  through  2009.^**  To  track  its 
performance  in  completing  inspections,  Coast  Guard  officials  stated  they 
have  the  ability  to  create  a  daily  report  to  inform  the  Captain  of  the  Port 
when  each  facility  in  his  or  her  area  of  responsibility  is  due  for  an 
inspection.  The  report  lists  all  MTSA-regulated  facilities,  shows  the  dates 
on  which  the  Coast  Guard  performed  its  last  two  required  inspections,  and 
highlights  any  facilities  that  are  coming  due  or  are  overdue  for  an 
inspection.  In  addition,  a  quarterly  reporting  tool  was  developed  for  Coast 
Guard  district  and  headquarters  officials  to  determine  if  facility  inspection 
requirements  were  being  met. 

The  Coast  Guard  also  reported  that  it  conducts  operational  activities  to 
secure  ferries,  including  conducting  boat  escorts  of  ferries,  implementing 
positive  control  measures — that  is,  stationing  armed  Coast  Guard 
personnel  in  key  locations  aboard  a  vessel  to  ensure  that  the  operator 
maintains  control — and  providing  a  security  presence  through  various 
actions.  Operation  Neptune  Shield  requires  Coast  Guard  units  to  escort  a 
certain  percentage  of  high  capacity  passenger  vessels  at  each  maritime 
security  threat  level  to  protect  against  an  external  threat,  such  as  a 
waterborne  improvised  explosive  device.**^  The  requirement  is  applicable 
to  all  types  of  high  capacity  passenger  vessels — cruise  ships,  ferries,  and 
excursion  vessels — in  a  Sector’s  area  of  responsibility,  and  is  not  specific 
to  ferries.  According  to  Coast  Guard  data,  although  16  of  28  Sectors  with 
high  capacity  passenger  vessels  operating  in  their  area  of  responsibility 


^‘Some  ferries  operate  out  of  public  access  facilities  for  which  the  Coast  Guard  does  not 
conduct  security  inspections.  For  those  facilities  the  Coast  Guard  does  inspect,  agency 
guidance  requires  that  inspections:  (a)  ensure  the  facility  complies  with  the  Facility 
Security  Plan;  (b)  ensure  the  approved  Facility  Security  Plan/Alternative  Security  Program 
adequately  addresses  the  performance-based  criteria  as  outlined  in  33  CFR  105;  (c)  ensure 
the  adequacy  of  the  Facility  Security  Assessment  and  the  Facility  Vulnerability  and  Security 
Measures  Summary  (Coast  Guard-6025);  and  (d)  ensure  that  the  measures  in  place 
adequately  address  the  vulnerabilities. 

^^The  total  number  of  MTSA-regulated  ferry  facilities  can  vary  from  year  to  year  due  to 
some  facilities  receiving  waivers  from  MTSA  regulations  or  discontinuing  their  operations. 

^“Operation  Neptune  Shield  escort  percentages  cU'e  classified.  To  meet  escort  requirements, 
the  Coast  Guau'd  may  receive  assistance  from  local  law  enforcement,  provided  the 
escorting  vessel  is  equipped  comparably  to  Coast  Guard  vessels.  According  to  Coast  Guard 
officials,  the  Captain  of  the  Port  uses  historical  data  for  the  purpose  of  determining  which 
ferries  to  escort. 
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met  or  exceeded  the  number  of  required  escorts  in  calendar  year  2009,  12 
did  not  meet  their  escort  requirement.^''  However,  Coast  Guard  officials 
reported  that  some  of  the  Sectors  that  did  not  meet  escort  requirements 
may  not  have  had  high  capacity  passenger  ferries  operating  in  their  area  of 
responsibility,  but  instead  may  have  had  other  high  capacity  passenger 
vessels,  such  as  cruise  ships.'^''  Moreover,  Operation  Neptime  Shield  allows 
the  Captain  of  the  Port  the  latitude  to  manage  risk  and  shift  resources  to 
other  priorities  when  deemed  necessary,  for  example,  when  resomces  are 
not  available  to  fulfill  all  missions  simultaneously.  Officials  from  one 
Sector  reported  that  its  local  law  enforcement  agency  has  a  large  presence 
in  the  port,  providing  a  presence  on  the  ferries  and  protecting  security 
zones.  See  figure  2  for  a  depiction  of  Coast  Guard  units  escorting  ferries. 


Figure  2:  Coast  Guard  Escorts  of  Ferries 


Source:  U.S.  Coast  Guard. 


In  addition  to  conducting  escorts  and  positive  control  measures,  the  Coast 
Guard  provides  a  security  presence  through  other  activities,  including 
patrolling  areas  in  which  ferries  operate  using  airborne,  waterborne,  and 
shoreside  assets.  In  addition.  Coast  Guard  persormel  may  board  docked 
ferries  for  the  purpose  of  providing  a  security  presence  once  they  are  in 
transit.  For  example,  at  one  location  we  visited,  we  accompanied  a  Coast 
Guard  Vessel  Boarding  Security  Team,  which  boarded  the  ferry  and  rode 
for  two  consecutive  trips  to  provide  a  security  presence  as  part  of  its 
regular  patrol  duties. 


“Seven  of  the  Coast  Guard’s  36  Sectors  did  not  have  any  type  of  high  capacity  passenger 
vessel  operating  within  their  respective  area  of  responsibility. 

“Coast  Guard  data  on  escorts  do  not  differentiate  between  types  of  high  capacity  passenger 
vessels,  such  as  ferries,  cruise  ships,  or  excursion  vessels.  Accordingly,  it  is  not  possible  to 
determine  the  number  of  escorts  that  were  performed  on  ferries  or  the  number  of  ferry 
transits  that  did  not  receive  escorts. 
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TSA  Also  Has  a  Role  in 
Ferry  and  Ferry  Facility 
Security 


TSA  supports  ferry  security  by  demonstrating  a  security  presence, 
providing  training,  and  implementing  pilot  programs  involving  security 
technologies.  Providing  a  security  presence,  TSA’s  Visible  Intermodal 
Prevention  and  Response  (VIPR)  teams  are  comprised  of  federal  air 
marshals,  surface  transportation  security  inspectors,  transportation 
security  officers,  behavior  detection  officers,  and  explosives  detection 
canine  teams.  In  July  2010,  TSA  officials  reported  that  they  had  deployed 
VIPR  teams  to  ferry  systems  319  times  since  calendar  year  2006.  Law 
enforcement  officials  in  one  location  stated  they  had  participated  in  one 
VIPR  operation  each  year  from  2007  to  2009.  In  another  location,  the  Coast 
Guard  Sector  cited  VIPR  operations  among  other  best  practices  for 
ensuring  the  security  of  high  capacity  passenger  ferries.  In  addition  to  its 
security  presence,  TSA  developed  training  courses  to  educate  passenger 
vessel  employees  on  maritime  security  issues  such  as  crowd  control, 
improvised  explosive  detection  recognition,  and  hijacking  procedures. 

TSA  also  provides  training  through  its  Intermodal  Security  Training 
Exercise  Program,  which  allows  maritime  security  stakeholders  to 
practice  security  exercises  on  ferries  and  provides  training  on  explosive 
devices.  TSA  also  accepts  maritime  security  stakeholders  into  its  explosive 
trace  detection  canine  training  program.^®  Law  enforcement  officers 
affiliated  with  a  ferry  system  we  visited  reported  they  were  among  the  first 
ferry  operators  to  be  accepted  into  the  TSA  program,  which  has  helped 
them  to  integrate  four  canines  into  their  security  operation. 

TSA  also  reported  that  it  conducts  pilot  programs  at  transportation 
systems,  including  ferry  systems,  through  its  Security  Enhancement  and 
Capabilities  Augmentation  Program.  TSA  documents  state  that  the 
program  gives  TSA  the  opportunity  to  network  with  different  ferry 
operators  across  the  United  States,  test  emerging  technologies,  and 
develop  strategies  that  the  agency  can  use  to  respond  to  specific  threats 
that  arise  from  new  intelligence  or  major  events.  TSA  officials  stated  that 
these  pilots  help  to  determine  how  technologies  work  in  different 
environments  and  in  large-scale  applications,  and  allow  local  agencies  to 
try  the  technologies.  According  to  one  ferry  operator,  as  part  of  their 
participation  in  TSA  pilot  programs,  they  provided  feedback  to  TSA  in 
response  to  pilots  that  have  been  tested  in  their  respective  systems.  TSA 
officials  also  stated  that  the  agency  has  visited  approximately  12  passenger 


“TSA’s  canine  training  program  consists  of  a  10-week  course  which  pairs  law  enforcement 
officers  from  across  the  country  with  canines  specifically  bred  for  the  program.  Officers 
and  canines  learn  to  work  together  while  being  trained  to  locate  and  identify  a  wide  variety 
of  dangerous  materials. 
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vessel  venues  since  2003  to  test  technologies  used  in  the  screening  of 
passengers,  baggage,  and  stores  to  be  loaded  on  passenger  vessels. 
Although  TSA  does  not  track  implementation  of  piloted  screening 
technologies,  officials  reported  that  five  passenger  facility  operators,  some 
of  which  were  ferry  facihty  operators,  have  adopted  new  technologies  as  a 
result  of  participating  in  a  TSA  pilot.  See  figure  3  for  a  photographic 
depiction  of  a  technology  used  to  screen  vehicles  for  explosives  that  TSA 
piloted  at  a  ferry  system. 


Figure  3:  TSA  Testing  of  a  Vehicle  Screening  Technology 


Source: Transportation  Security  Administration. 


For  International  Ferries 
That  Enter  U.S.  Ports,  CBP 
Carries  Out  Several 
Activities 


CBP  reports  that  it  conducts  inspections  on  international  ferries  that 
arrive  in,  or  are  bound  for  a  U.S.  port,  and  deploys  radiation  detection 
technologies  at  international  ferry  crossings.  In  the  United  States,  CBP 
inspects  passengers,  bags,  vehicles,  and  crew  that  disembark  from 
international  ferries.  Additionally,  CBP  officers  based  in  Canada  conduct 
admissibility  inspections  of  U.S.-bound  ferry  passengers.  Furthermore,  the 
SAFE  Port  Act  of  2006  required  CBP  to  determine  if  it  could  expand  its 
international  presence.  Specifically,  the  act  required  CBP  to  seek  to 
develop  a  plan  by  February  2007  for  the  inspection  of  passengers  and 
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vehicles  before  they  board  a  vehicle-carrying  ferry  bound  for  the  United 
States.  In  2009,  CBP  concluded  that  such  actions  would  not  be  feasible, 
and  in  a  2009  letter  to  Congress,  listed  conditions  which  would  prevent  the 
agency  from  examining  all  persons  seeking  to  enter  the  United  States. 
Finally,  CBP  uses  radiation  detectors  called  portal  monitors  to  screen 
vehicles  inbound  from  Canada  as  they  disembark  in  the  United  States. 

CBP  officials  stated  that  beginning  in  March  2008,  radiation  portal 
monitors  were  deployed  to  U.S.  facilities  that  receive  ferries  inbound  from 
Canada.  By  October  2009,  CBP  officials  reported  that  11  radiation  portal 
monitors  had  been  deployed,  and  in  July  2010,  officials  reported  that  4 
additional  devices  were  estimated  to  be  deployed  by  2013. 


Ferry  Operators  Have 
Taken  Action  to  Enhance 
Security  and  Their  Ability 
to  Meet  Security  Standards 
Has  Been  Measured 
through  Inspections 


Ferry  and  ferry  facility  operators  develop  and  implement  secnrity 
plans.  Pursuant  to  the  ISPS  Code  and  its  guidance,  and  Coast  Guard’s 
implementing  MTSA  regulations  and  guidance,  like  other  regulated  vessels 
and  facilities,  ferry  and  ferry  facility  operators  must  develop  and 
implement  security  plans  that  address,  among  other  things,  concerns 
identified  in  their  security  assessments.  Security  plans  must  be  reviewed 
and  approved  by  the  Coast  Guard.  Coast  Guard  officials  stated  that  as  part 
of  this  process,  the  Captain  of  the  Port  determines  whether  a  plan’s 
security  measures  address  the  concerns  identified  in  a  ferry  or  ferry 
facility’s  security  assessment.  To  address  requirements  in  their  security 
plans,  ferry  operators  we  interviewed  reported  using  measures  such  as 
establishing  a  security  presence  that  may  be  provided  by  either  their  own 
law  enforcement  branches  or  state  and  local  law  enforcement  agencies; 
conducting  security  sweeps  of  the  ferries;  implementing  access  controls 
such  as  cameras,  posting  signage  advising  of  security  procedures,  and 
installing  proximity  card  door  systems;  and  screening  vehicles.  See  figure 
4  for  a  photograph  depicting  security  signage  posted  at  a  ferry  facility. 


"Tub.  L.  No.  109-347,  §  122,  120  Stat.  1884,  1899  (2006). 

"®ln  addition  to  security  actions  taken  on  behalf  of  the  ferry  operators,  state  and  local  law 
enforcement  agencies  may  engage  in  ferry  security  efforts  as  part  of  their  broader  law 
enforcement  or  antiterrorism  activities. 
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Figure  4:  Security  Signage  Posted  at  a  Ferry  Facility 


SECURITY  NOTICE 
MARITIME  SECURITY  LEVEi[1 

SECURITY  MEASURES  MAY  INCLUDE  ID  CHECKS  AND 
SCREENING  OF  PERSONS/BELONGINGS/VEHICLES 
ENTERING  THIS  FACILITY  IS  DEEMED  VALID  CONSENT  TO 
ID  CHECK/SCREENING/INSPECTION.  FAILURE  TO  CONSENT 
OR  SUBMIT  TO  ID  CHECK/SCREENING/INSPECTION  WILL 
RESIJlT  in  denial  or  revocation  of  AUTHORIZATION  TO* 
ENTER  THIS  FACILITY 


Source:  GAO. 


Security  methods  varied  across  ferry  operations.  Ferry  systems  had  a 
range  of  methods  for  providing  onboard  security,  though  the  frequency 
and  means  they  used  varied  across  ferry  systems.  For  example,  at  one 
ferry  system  we  visited,  local  law  errforcement  officers  rode  on  all  ferry 
transits,  while  another  ferry  system  had  state  law  enforcement  officers 
ride  on  selected  trips.  Similarly,  all  of  the  ferry  systems  we  visited 
conducted  screening  operations  to  help  protect  against  a  passenger-  or 
vehicle-home  improvised  explosive  device,  but  their  frequency  and 
screening  methods  also  varied  across  systems.  While  the  Coast  Guard  sets 
the  minimum  screening  requirements  at  each  maritime  security  threat 
level, Coast  Guard  guidance  states  that  each  ferry  operator  is  permitted 
to  enact  measures  that  protect  passengers  without  unduly  compromising 
service  to  the  community.  Accordingly,  operators  may  select  the  screening 
method  most  appropriate  for  their  respective  operation  and  within  their 


“The  maritime  security  threat  level  is  a  three  tiered  rating  of  the  terrorist  threat  in  the 
maritime  environment. 
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resources,  provided  the  Coast  Guard  deems  the  method  sufficient  to 
mitigate  security  risks.  On  our  site  visits,  we  observed  variation  in 
screening  operations  with  respect  to  (a)  the  frequency  of  screening, 

(b)  the  personnel  involved  in  screening,  and  (c)  the  screening  methods 
used. 

With  respect  to  screening  frequency,  port  security  stakeholders  with 
screening  responsibilities  at  five  of  the  six  ferry  systems  we  interviewed 
generally  reported  that  they  met  the  minimum  screening  requirement  set 
forth  by  the  Coast  Guard,  and  one  ferry  system  reported  that  it  screened 
all  passengers,  bags,  and  crew.^"  This  operator  noted  that  its  screening 
frequency  was  determined  by  the  U.S.  Park  Police  because  the  ferry 
transits  to  a  national  park.  According  to  the  U.S.  Park  Police,  this  national 
park  is  listed  as  the  national  icon  that  receives  the  greatest  number  of 
threats.  During  our  site  visits,  we  also  observed  one  system  that  did  not 
appear  to  be  screening  according  to  its  standards,  but  we  did  not 
determine  any  failure  to  meet  minimum  screening  requirements. 

Ferry  and  ferry  facility  operators  utilize  various  personnel  in  their 
screening  operations.  Federal  regulations  require  personnel  with  specific 
security  responsibilities — such  as  screening — to  have  knowledge  through 
training  or  equivalent  job  experience  in  certain  areas  and  require 
operators  to  maintain  personnel  training  records. Based  on  our  site  visits, 
screening  was  performed  by  a  variety  of  personnel  in  these  locations, 
including  ferry  crew  members,  contracted  security  screeners,  and  state  or 
local  law  enforcement.^^ 


®°In  one  location  the  Coast  Guard  approved  a  slight  decrease  in  the  minimum  vehicle 
screening  requirements  so  the  ferry  operator  could  more  randomly  screen  and  more 
effectively  mitigate  risk. 

^‘Required  knowledge  includes  areas  such  as  current  security  threats  and  patterns;  testing, 
calibration,  operation,  and  maintenance  of  security  equipment  and  systems;  methods  of 
physical  screening  of  persons;  inspection,  control,  and  monitoring  techniques;  recognition 
of  characteristics  and  behavioral  patterns  of  persons  who  are  likely  to  threaten  security; 
and  recognition  and  detection  of  dangerous  substances  and  devices. 

^At  one  ferry  system  where  both  law  enforcement  and  contractors  participated  in  security 
operations,  officials  stated  that  personnel  conducting  screening  may  have  varying 
authorities.  For  example,  sworn  law  enforcement  officers  would  typically  have  the 
authority  to  take  additional  actions  beyond  those  that  ferry  employees  or  contractors  may 
have  been  able  to  take,  such  as  detaining  a  passenger  suspected  of  committing  or 
attempting  to  commit  an  illegal  act. 
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Among  the  ferry  systems  we  visited,  canine  and  manual  screening 
methods  were  utilized.  Additionally,  one  passenger-only  ferry  system  we 
visited  screened  passengers  and  baggage  using  walk-through  metal 
detectors  and  baggage  belts.  According  to  a  Coast  Guard  report  on  ferry 
security,  canine  screening  provides  a  reliable  and  proven  method  for 
detecting  concealed  explosives.  The  report  also  states  that  canines 
provide  advantages  of  superior  mobility  and  the  ability  to  follow  a  scent 
directly  to  its  source — citing  that  canines  have  a  higher  probability  of 
detection  compared  to  manual,  x-ray,  and  trace  detection  methods. 

Finally,  the  report  states  that  while  manual  screening  is  considered  a 
nontechnological  screening  option,  it  allows  for  higher  passenger 
throughput  than  other  screening  devices. 

Screening  operations  differ  by  ferry  system  due  to  various  factors, 
including  system  characteristics,  state  laws,  and  resource  availability. 
System  characteristics  like  passenger  throughput  influence  the  screening 
method  an  operator  may  feasibly  implement,  as  passenger  processing 
rates  vary  across  technologies.  For  example,  two  ferry  operators  we 
interviewed  reported  that  certain  screening  technologies  would  not  be 
able  to  accommodate  their  high  passenger  throughput.  Additionally,  state 
provisions,  under  certain  circumstances,  may  limit  the  ability  of  security 
personnel  to  perform  certain  screening  methods.  For  example,  state  police 
officers  who  perform  canine  screening  at  one  ferry  system  we  visited 
reported  that  state  case  law  generally  prohibits  them  from  opening  a 
vehicle  trunk  without  the  driver’s  consent  or  a  search  warrant.  However, 
when  a  canine  detects  a  potential  threat  associated  with  a  vehicle  and  the 
driver  does  not  consent  to  trunk  screening,  officers  notify  the  ferry 
captain.  Under  the  ferry  system’s  security  procedures,  anyone  denying 
such  a  screening  will  be  prohibited  from  boarding,  preventing  a  potential 
risk  from  boarding  the  ferry.  Furthermore,  funding  may  also  pose  a 
limiting  factor  in  designing  security  operations.  A  2005  Coast  Guard  report 
on  ferry  screening  indicates  that  costs  vary  across  screening  methods, 
stating  that  canine  screening  is  over  three  times  more  expensive  than 
manual  screening.  The  report  also  notes  that  startup  programs  for  two 
canines  and  their  handlers  are  estimated  to  cost  $250,000.^“  In  July  2010, 


®U.S.  Coast  Guard  Research  and  Development  Center,  National  Ferry  Security  Study 
(Groton,  Conn.:  May  2005). 

^*U.S.  Coast  Guard  Research  and  Development  Center,  National  Ferry  Security  Study 
(Groton,  Conn.:  May  2005). 
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one  port  security  stakeholder  we  interviewed  stated  that  in  addition  to 
training  costs,  their  four  canine  units  cost  $160,000  per  year. 


Coast  Guard  data  show  that  while  ferry  security  deficieucy  rates 
varied  compared  to  other  vessel  types,  ferry  facility  deficieucy 
rates  were  geuerally  lower  compared  to  other  facility  types.  Of  the 

nearly  700  inspections  conducted  on  high  capacity  passenger  ferries 
during  calendar  years  2006  through  2009,  the  Coast  Guard  identified  48 
deficiencies.^*^  Officials  stated  that  overall,  ferry  security  deficiencies  were 
generally  no  more  severe  than  deficiencies  cited  for  cargo  vessels  and 
other  passenger  vessels.  As  shown  in  figure  5,  among  nine  vessel  types,  the 
relative  ranking  of  security  deficiency  rates  for  ferries — including  both 
high  capacity  and  smaller  capacity  passenger  ferries — ^varied  from  2006  to 
2009. 


®®The  reported  number  of  deficiencies  does  not  include  deficiencies  that  may  still  be  open. 
Coast  Guard  officials  reported  that  deficiencies  could  be  considered  open  for  a  number  of 
reasons,  such  as  an  appeal  of  the  deficiency.  Officials  stated  that  prior  year  deficiencies 
should  all  be  closed,  though  it  is  possible  that  some  may  still  be  open.  According  to  the 
Coast  Guard’s  standardized  inspection  checklist,  inspectors  can  check  operators’ 
compliance  with  approximately  150  items,  many  of  which  could  result  in  more  than  one 
deficiency.  In  addition  to  the  items  addressed  during  the  inspection,  other  items  such  as 
failure  to  resolve  or  acquire  waivers  for  previously  cited  deficiencies  could  generate  further 
deficiencies.  Conversely,  some  inspection  items  may  not  apply  to  certain  facilities.  For 
example,  one  item  applies  only  to  facilities  which  serve  vessels  that  carry  vehicles. 
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Figure  5:  Security  Deficiencies  by  Vessel  Type,  2006  through  2009 


Deficiency  Rate^ 
1.00 


“Within  each  vessei  type,  the  deficiency  rate  is  the  number  of  deficiencies  divided  by  the  number  of 
reguiated  vesseis  each  year. 


Coast  Guard  officials  stated  that  ferry  security  deficiencies  were 
commonly  found  in  the  following  areas:  security  plan  audits  and 
amendments;  drills  and  exercises;  records  and  documentation;  and  access 
control  procedures,  including  monitoring  of  secure  and  restricted  areas. 
Coast  Guard  officials  at  agency  headquarters  reported  that  operators  were 
particularly  responsive  to  correcting  deficiencies,  because  they 
understood  that  deficiencies  could  lead  the  Coast  Guard  to  remove  a 
vessel  from  service  and  interrupt  operations. 

With  regard  to  ferry  facilities,  the  Coast  Guard  identified  nearly  1,300 
deficiencies  in  conducting  a  total  of  nearly  3,200  ferry  facility  inspections 
during  calendar  years  2006  through  2009.  According  to  Coast  Guard 
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officials,  the  majority  of  the  deficiencies  were  related  to  (1)  operations  or 
management  issues,  such  as  the  failure  of  the  security  officers  to  properly 
perform  their  duties  related  to  required  drills  or  personnel  training  and  (2) 
documentation  issues  such  as  the  security  officer  failing  to  post  security 
signage,  document  security  responsibilities,  drills  or  training,  or  submit 
security  plan  amendments.  Coast  Guard  officials  stated  that  compared  to 
other  types  of  facilities,  ferry  facilities  tended  to  have  more  security 
requirements  yet  they  generally  outperformed  other  types  of  facilities  in 
meeting  requirements.  As  shown  in  figure  6,  ferry  facilities  generally  had 
the  lowest  deficiency  rate  compared  to  eight  other  facilities  during  the 
period  2006  through  2009. 


Figure  6:  Security  Deficiencies  by  Facility  Type,  2006  through  2009 
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Source:  U.S.  Coast  Guard. 

“Within  each  faciiity  type,  the  deficiency  rate  is  the  number  of  deficiencies  recorded  each  year  divided 
by  the  number  of  reguiated  faciiities  recorded  in  2008.  Ferry  faciiities  may  service  both  high  capacity 
ferries  and  smaiier  ferries. 
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The  Coast  Guard  May  Be  The  Coast  Guard  has  reported  taking  various  actions  to  help  secure 

Missing  Opportunities  to  ferries,  but  may  be  missing  opportunities  to  further  enhance  ferry  security, 

Enhance  Ferry  Security  particularly  with  respect  to  enhancing  screening  measures  because  it  has 

not  evaluated  and,  if  determined  warranted,  acted  on  all  of  the  findings 
and  recommendations  from  several  ferry  security  reports  completed  in 
2005  and  2006.  In  addition,  the  Coast  Guard  has  not  reassessed  its  vehicle 
screening  requirements  since  2004. 


The  Coast  Guard  Has  Not 
Evaluated  and,  if 
Determined  Warranted, 
Acted  on  Report  Findings 
and  Recommendations 


The  Coast  Guard  spent  $1.5  million  on  contracted  studies  related  to  ferry 
security,  but  has  not  evaluated  and,  if  determined  warranted,  taken  action 
to  address  all  of  the  findings  and  recommendations  from  these  studies 
even  though  their  results  were  issued  in  2005  and  2006.  Recognizing  the 
security  risk  posed  by  vehicle-borne  improvised  explosive  devices,  the 
Coast  Guard,  in  consultation  with  various  other  entities,  initiated  five 
studies  to  conduct  more  comprehensive  research  and  development  to 
enhance  security  on  ferries.^®  According  to  Coast  Guard  documentation 
from  2004,  these  studies  were  aimed  at  establishing  a  new  benchmark  for 
ferry  screening  and  enhancing  the  agency’s  ability  to  focus  on  improving 
security  practices,  screening  technology,  and  identification  of  explosive 
hazards.  In  addition,  the  document  states  that  the  Coast  Guard  should 
convene  an  interagency  working  group  with  private  sector  representation 
from  the  ferry  industry  to  identify  areas  for  improvement  in  the  screening 
process  by  discussing  (a)  previously  implemented  screening  practices  and 
(b)  information  from  the  studies  once  they  were  completed.  The  five 
studies  resulted  in  three  reports  with  key  findings  related  to  the  screening 
of  vehicles  boarding  a  ferry,  and  two  of  them  made  recommendations  to 
the  Coast  Guard. 


The  ferry  security  reports  included  several  findings  and  recommendations. 
Two  of  the  reports  included  classified  recommendations  which  can  not  be 
discussed  in  our  report.  The  third  report,  issued  by  ABSG  Consulting  in 
April  2005,  reported  on  the  completed  consequence  studies  that  were 
conducted  and  included  classified  findings  on  the  potential  consequences 


®®The  five  studies  included  a  general  study,  a  consequence  assessment,  an  explosion 
screening  effectiveness  and  technology  study,  a  study  to  collect  data  on  screening 
technology  in  the  ferry-operating  environment,  and  a  system  analysis  and  deterrence 
effectiveness  study.  These  studies  were  conducted  by  members  of  an  integrated  product 
team  that  included  members  from  the  Coast  Guard’s  Research  and  Development  Center, 
DHS’s  Science  and  Technology  Directorate,  Department  of  Transportation’s  Maritime 
Administration,  the  Department  of  Defense’s  Technical  Support  Working  Group,  TSA, 
Homeland  Security  Institute,  and  ABSG  Consulting. 
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of  a  vehicle-borne  improvised  explosive  device,  but  no  recommendations 
resulted  from  this  report.  The  objectives  of  the  consequences  studies  were 
to  predict  structural  damage  to  the  selected  ferries  from  different  charge 
sizes,  locations,  and  methods  of  attack. 

The  Coast  Guard  has  not  evaluated  and,  if  determined  warranted,  taken 
actions  on  the  ferry  security  reports.  Standards  for  Internal  Control  in  the 
Federal  Government  state  that  agencies  should  have  policies  and 
procedures  for  ensuring  that  findings  of  audits  and  other  reviews  are 
promptly  resolved.  The  guidance  further  states  that  managers  are  to 
(1)  promptly  evaluate  findings  from  audits  and  other  reviews,  including 
those  showing  deficiencies  and  recommendations  reported  by  auditors 
and  others  who  evaluate  agencies’  operations;  (2)  determine  proper 
actions  in  response  to  findings  and  recommendations  from  audits  and 
reviews;  and  (3)  complete,  within  established  time  frames,  all  actions  that 
correct  or  otherwise  resolve  the  matters  brought  to  management’s 
attention.^^  Although  Coast  Guard  program  officials  stated  that  the  agency 
does  not  have  a  process  for  addressing,  responding  to,  or  documenting 
recommendations  stemming  from  research  and  development  studies,  they 
stated  that  once  they  receive  a  report  they  generally  review  its 
recommendations  and  seek  feedback  from  Coast  Guard  program 
specialists  and  field  units  as  well  as  industry  stakeholders.  After  this. 

Coast  Guard  officials  stated  that  they  work  with  port  captains  and  industry 
stakeholders  to  implement  feasible  security  measures.  Coast  Guard 
Research  and  Development  officials  we  met  with  told  us  that  after  the 
2005  National  Ferry  Security  Study  was  issued,  they  communicated  the 
report  findings  to  various  entities,  including  the  Coast  Guard 
Commandant,  Area  Maritime  Security  Committees,  and  stakeholders  at  the 
ports  included  in  the  ferry  study.  In  addition,  a  2005  informational 
memorandum  to  the  Secretary  of  Homeland  Security  from  the 
Commandant  indicated  that  the  Coast  Guard,  in  consultation  with  TSA  and 
the  Office  for  Domestic  Preparedness,  planned  to  implement  new  security 
measures  to  mitigate  the  risk  of  an  improvised  explosive  device  as  a  result 
of  the  ferry  security  studies.  However,  in  May  2010,  Coast  Guard  program 


“’Federal  guidance  on  internal  control  also  states  that  the  resolution  process  begins  when 
audit  or  other  review  results  are  reported  to  management,  and  is  completed  only  after 
action  has  been  taken  that  (1)  corrects  identified  deficiencies,  (2)  produces  improvements, 
or  (3)  demonstrates  the  findings  and  recommendations  do  not  warrant  management  action. 
In  addition,  the  consideration  of  findings  of  reviews  and  audits  is  a  means  for  an  agency  to 
identify  risk.  See  GAO,  Standards  for  Internal  Control  in  the  Federal  Government, 
GAO/AIMD-00-21.3.1  (Washington,  D.C.:  November  1999). 


Page  30 


GAO-11-207  Maritime  Security 


officials  stated  that  there  were  no  current  actions  being  taken  to  address 
the  findings  and  recommendations  from  the  National  Ferry  Security  Study. 
Coast  Guard  officials  explained  that  the  ferry  security  reports  were 
released  when  the  agency  was  undergoing  an  internal  reorganization  and 
as  a  result  the  reports  were  not  sent  to  the  appropriate  unit  after  the 
reorganization — which  they  also  believe  is  the  likely  reason  for  why  no 
further  actions  were  taken  to  evaluate  or  address  the  reports’  findings  and 
recommendations. 

In  June  2010,  Coast  Guard  program  officials  reported  that  they  were  taking 
actions  to  improve  ferry  security  through  ongoing  rulemaking  and 
guidance  development  efforts.  Coast  Guard  officials  stated  that  they  were 
in  the  process  of  revising  the  MTSA  regulations,  through  which  they  would 
amend  security  training  for  vessel  and  facility  personnel — including  ferry 
screening  persormel.  Coast  Guard  officials  stated  that  they  began  these 
revisions  in  late  2006,  but  had  to  divert  their  attention  to  the 
implementation  of  the  Transportation  Worker  Identification  Credential 
program  in  2007,  and  thus,  were  delayed  in  developing  the  MTSA 
regulation  revisions.  The  Coast  Guard  plans  to  finalize  the  MTSA 
regulatory  revisions  through  the  proposed  rulemaking  process.  In 
addition.  Coast  Guard  officials  stated  that  they  have  been  developing  a 
Navigation  and  Vessel  Inspection  Circular  for  about  2  years  to  provide 
updated  guidance  for  ferry  screening.  The  guidance  is  intended  to  update 
existing  screening  policies  and  assist  owners  or  operators  of  ferries  and 
ferry  facilities  in  the  prevention  of  security  incidents  by  developing  and 
implementing  more  effective  passenger  screening  programs  appropriate 
for  each  maritime  security  threat  level.  Although  the  officials  reported 
these  efforts  initially  began  in  about  2005  or  2006,  they  did  not  expect  the 
Navigation  and  Vessel  Inspection  Circular  to  be  published  until  fall  2010. 
Coast  Guard  officials  further  reported  that  they  plan  to  review  the  2005 
and  2006  reports  to  determine  if  additional  changes  should  be 
incorporated  into  their  ongoing  development  of  the  Navigation  and  Vessel 
Inspection  Circular.  However,  officials  stated  that  they  could  not  delay  the 
publication  of  the  MTSA  regulatory  revisions  currently  under 
development,  and  thus,  it  was  unlikely  they  would  make  any  major  ferry- 
related  changes  in  this  rulemaking  as  a  result  of  reviewing  the  2005  and 
2006  reports.  Furthermore,  Coast  Guard  officials  also  informed  us  that 
DHS  is  currently  evaluating  the  feasibility  of  developing  standards  for 
nonfederal  canine  programs.  The  Captain  of  the  Port  determines  whether 
the  qualifications  of  the  canine  program  used  by  screening  personnel  are 
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sufficient,  as  standards  for  private  or  nonfederal  canine  programs  do  not 
exist  as  they  do  for  federal  canine  programs.^® 

Although  these  ongoing  efforts  may  address  some  of  the  findings  and 
recommendations  from  the  2005  and  2006  reports,  it  is  not  evident  that  the 
Coast  Guard  utilized  the  reports  or  their  recommendations  to  inform  the 
agency’s  decision  making,  as  officials  could  not  confirm  whether  the  2005 
and  2006  reports  were  the  catalyst  for  the  agency’s  actions.  In  addition. 
Coast  Guard  officials  confirmed  that  the  ongoing  actions  will  not  address 
all  of  the  findings  and  recommendations  from  the  reports.  As  a  result  of 
our  work  on  ferry  security,  in  August  2010,  Coast  Guard  officials  stated 
that  they  believe  the  ferry  security  reports  can  still  provide  valuable 
information  and  they  plan  to  begin  evaluating  the  reports  in  fall  2010.  After 
conducting  this  evaluation  of  the  reports  and  considering  their 
recommendations,  the  Coast  Guard  could  be  in  a  better  position  to 
determine  if  additional  actions  could  be  taken  to  improve  the  security  of 
ferries  and  their  facilities.  Moreover,  fully  evaluating  the  study  results 
could  assist  the  Coast  Guard  in  determining  if  its  current  proposed  actions 
will  address  previously  identified  deficiencies. 


The  Coast  Guard  Has  Not 
Reassessed  Vehicle 
Screening  Requirements  in 
Accordance  with  Agency 
Guidance 


Although  agency  documents  have  suggested  that  the  Coast  Guard  reassess 
its  vehicle  screening  requirements  for  ferry  operators,  the  Coast  Guard  has 
not  taken  action  to  update  these  requirements  since  2004.^®  Along  with 
MTSA  regulations  pertaining  to  vehicle  screening,  the  Coast  Guard 
estabhshed  minimum  screening  requirements  for  vehicles  boarding  ferries 
in  a  November  2003  Coast  Guard  maritime  security  directive. ^  In 
September  2004,  the  Coast  Guard  issued  another  maritime  security 
directive  which  increased  minimum  vehicle  screening  requirements  for 


'"‘Participants  in  TSA’s  Tr2insit  Security  Grant  Progr2im  and  DHS’s  Homeland  Security  Grant 
Program  are  required  to  maintain  data  to  document  compliance  with  guidelines  for  their 
explosives  detection  cemine  teams.  These  guidelines  were  developed  by  a  scientific 
working  group  that  included  officials  from  DHS.  See  GAO,  TSA’s  Explosives  Detection 
Canine  Program:  Status  of  Increasing  Number  of  Explosives  Detection  Canine  Teams, 
GAO-08-933R  (Washington,  D.C.:  July  2008). 

“The  requirements  employed  a  random  strategy  designed  to  provide  em  effective  level  of 
deterrence  while  also  balancing  the  need  to  maintain  an  efficient  flow  of  commerce. 

"While  the  Coast  Guard  required  ferry  operators  to  incorporate  screening  into  their 
security  plans — plans  the  Coast  Guard  must  approve — operators  were  permitted  to  select 
the  method  of  screening.  The  Captain  of  the  Port  may  change  screening  requirements 
based  on  changes  in  the  risk  to  or  threat  level  at  the  port. 
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high  capacity  passenger  ferries,  citing  the  use  of  a  vehicle-home 
improvised  explosive  device  by  a  terrorist  as  a  primary  concern  for 
ferries/^  The  directive  cited  three  factors  that  contributed  to  the  decision 
to  increase  vehicle  screening  requirements:  (1)  an  increase  in  suspicious 
activity  in  the  preceding  2  years,  (2)  possible  surveillance  of  ferry 
operations  during  that  same  period,  and  (3)  an  anticipated  increase  in  risk 
associated  with  the  January  2005  presidential  inauguration.  The  directive 
further  stated  that  following  the  period  of  increased  risk  related  to  the 
inauguration  and  the  completion  of  the  aforementioned  studies  on  ferry 
security,  screening  requirements  would  be  reassessed.  The  directive  also 
called  for  the  establishment  of  a  workgroup  to  address  the  new  screening 
levels  and  develop  a  strategy  to  monitor  vehicle  screening  effectiveness. 
Lastly,  a  2004  Coast  Guard  document  on  ferry  screening  stated  that  the 
agency  should  monitor  threats  to  ferries  and  continually  reassess 
screening  requirements  relative  to  specific  threats. 

Despite  Coast  Guard  documents  from  2004  stating  that  a  reassessment  of 
the  screening  requirements  should  be  conducted  when  the  ferry  security 
studies  were  completed  or  if  the  threat  were  to  change — both  of  which 
have  occurred — as  of  May  2010,  Coast  Guard  officials  stated  that  they  had 
not  taken  action  to  reassess  and  update  the  requirements  since  the  2004 
security  directive.  Reviewing  the  screening  requirements  could  provide  the 
Coast  Guard  with  reasonable  assurance  that  it  is  setting  standards  for 
ferry  operators  that  mitigate  current  threats  to  ferries  and  take  into 
account  the  needs  of  ferry  operators  in  maintaining  their  operations. 

Again,  as  a  result  of  our  work  on  ferry  security,  in  August  2010,  Coast 
Guard  officials  stated  that  they  intended  to  begin  reviewing  the  ferry 
security  reports  in  fall  2010.  According  to  one  of  these  officials,  although 
the  agency’s  review  of  the  ferry  security  reports  could  result  in  a  change  to 
the  vehicle  screening  requirements,  the  agency  did  not  have  a  specific  plan 
to  reassess  the  vehicle  screening  requirements. 


Conclusions 


Given  the  attractiveness  of  ferries  as  targets  for  terrorists  and  the 
importance  of  ferry  systems  as  a  transportation  mode,  it  is  important  that 
maritime  security  stakeholders  regularly  assess  risks  and  take  action  to 
best  ensure  their  security.  Certainly,  federal  agencies  and  maritime 


"Through  the  security  directive  the  Coast  Guard  increased  minimum  screening 
requirements  for  vehicles  and  large  enclosed  vehicles  at  two  of  the  three  maritime  security 
threat  levels. 
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security  stakeholders  have  implemented  security  measures  to  enhance 
ferry  system  security,  and  in  2005,  the  Coast  Guard  recognized  the  need  to 
further  enhance  ferry  system  security.  However,  the  Coast  Guard’s 
attention  was  then  diverted  to  other  agency  priorities  and  thus  the  agency 
did  not  proactively  evaluate  and  take  action,  if  determined  appropriate,  on 
the  findings  and  recommendations  from  the  2005  and  2006  ferry  security 
reports.  The  reports  provide  information  for  potentially  improving  the 
detection  of  vehicle-borne  improvised  explosive  devices  and  enhancing 
security  across  the  nation’s  ferry  systems,  and  in  August  2010,  Coast 
Guard  officials  acknowledged  the  value  of  this  information.  Fully 
assessing  and  considering  these  report  findings  and  recommendations 
could  provide  the  Coast  Guard  with  valuable  information  that  could 
augment  ferry  security.  After  evaluating  the  report  findings  and 
recommendations,  the  Coast  Guard  could  be  in  a  better  position  to 
determine  what  additional  actions,  if  any,  should  be  taken  to  enhance  ferry 
security. 

In  addition,  although  Coast  Guard  documentation  from  2004  states  that  the 
agency  should  reassess  its  vehicle  screening  requirements  after  the  results 
of  the  ferry  security  reports  are  issued  or  if  the  threat  changes,  it  has  not 
yet  taken  action  to  do  so.  Taking  action  to  reassess  screening 
requirements  could  provide  the  Coast  Guard  with  key  information  to  help 
improve  its  vehicle  screening  requirements.  Thus,  the  Coast  Guard  could 
be  in  a  better  position  to  set  standards  for  ferry  operators  that  take  into 
consideration  the  needs  of  the  ferry  systems  to  maintain  operations  while 
also  protecting  against  current  threats. 


Recommendations 
Executive  Action 


for 


To  ensure  that  the  Coast  Guard  considers  all  known  options  for  securing 
the  ferry  transportation  system  and  is  not  missing  opportunities  to 
enhance  ferry  security,  we  recommend  that  the  Commandant  of  the  Coast 
Guard  take  the  following  two  actions: 


(1)  after  fully  evaluating  the  findings  and  recommendations  from  the  Coast 
Guard’s  2005  and  2006  ferry  security  reports,  take  appropriate  actions  to 
address  the  findings  and  recommendations  identified  in  these  reports;  and 


(2)  upon  review  of  the  reports,  ensure  that  vehicle  screening  requirements 
are  set  at  an  appropriate  level  that  considers  both  the  risks  to  and 
operating  requirements  of  ferry  systems,  and  when  warranted,  reassess 
screening  requirements  for  ferries  and  make  changes  as  appropriate. 
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Agency  Comments 

We  provided  a  draft  of  the  sensitive  version  of  this  report  to  the 
Departments  of  Homeland  Security,  State,  and  Interior  for  their  review  and 
comment.  DHS  did  not  provide  official  written  comments  to  include  in  our 
report.  However,  in  an  e-mail  received  on  September  23,  2010,  the  DHS 
liaison  stated  that  DHS  concurred  with  our  recommendations.  DHS 
provided  written  technical  comments,  which  we  incorporated  into  the 
report,  as  appropriate.  The  Departments  of  State  and  Interior  responded 
that  they  did  not  have  any  comments  on  the  report. 

We  are  sending  copies  of  this  report  to  the  Secretaries  of  Homeland 
Security,  the  Interior,  and  State;  and  interested  congressional  committees 
as  appropriate.  The  report  is  also  available  at  no  charge  on  the  GAO  Web 
site  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me 
at  (202)  512-9610  or  caldwells@gao.gov.  Contact  points  for  our  Offices  of 
Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last  page 
of  this  report.  Key  contributors  to  this  report  are  listed  in  appendix  I. 

Sincerely  yours. 


Stephen  L.  Caldwell 

Director,  Homeland  Security  and  Justice  Issues 
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